IT and security statement

SimpleDiagrams 5 for Mac works entirely offline. This version has no permission to connect to the internet, and it collects nothing about the people who use it. This page describes exactly what the current release can and cannot do, for anyone reviewing it before it is installed.

What the app can do

Sandbox and permissions

The app runs in Apple's App Sandbox. These are its only entitlements:

com.apple.security.app-sandbox
com.apple.security.files.user-selected.read-write: open and save files the user chooses
com.apple.security.print: print
keychain-access-groups: keep the licence key in the app's own Keychain group

The signature also carries com.apple.application-identifier and com.apple.developer.team-identifier, which identify the app and its developer and grant no access.

There is no com.apple.security.network.client entitlement, so macOS does not let the app open a network connection.

Data and privacy

No analytics, tracking, advertising or crash-reporting code is included. The privacy manifest declares no tracking and no collected data.
Diagrams are saved only where the user saves them, as ordinary documents, with macOS autosave and Versions.
Diagnostic messages go only to the Mac's own system log.
Some menu commands, such as Buy, Check for Updates, Release Notes and Online Help, open our website in the user's browser. Check for Updates includes the app's version and build number in the address so the page can tell whether a newer release exists. These are ordinary website visits, covered by our website privacy policy.

Signing and integrity

Signed with our Developer ID, built with the hardened runtime, notarized by Apple and stapled. The disk image and the installer package are signed and notarized too.
Two open-source libraries are included: ZIPFoundation and SVGPath. Their licences are listed in the app's third-party notices.
The current release is 5.0.16. It needs macOS 15 or later and runs on Apple silicon and Intel Macs.

Licence keys

A key is signed by us and checked on the Mac, offline. The app never contacts a licence server.
A key a person enters is stored in the data-protection Keychain on that Mac and is not synchronised to other devices.
A key your organisation deploys in a configuration profile is read from the profile each time and is never stored in the Keychain. Removing the profile removes that key from the Mac.
Each key names the person or the organisation it was issued to, and Help › Licence Information shows it.
Copies from the Mac App Store are paid for up front and have no key. The purchase is handled by the App Store, which contacts Apple; the app itself makes no purchase requests and still has no network permission.

Installing it for your people

Available now

A notarized disk image. This address serves the current release: https://simplediagrams.com/desktop/download/mac/
The published SHA-256 checksum is on the product page.
A notarized installer package (.pkg) for device management, with no scripts and no prompts. This address serves the current release: https://simplediagrams.com/desktop/download/SimpleDiagrams.pkg
One licence key for a whole organisation, deployed to every Mac in a configuration profile.
Copies from our website do not update themselves. You decide when a new version is installed.
The first time it opens, each person is asked to accept the licence agreement, unless your organisation deploys an organisation key in a configuration profile. Your organisation accepts the agreement for its people when it buys that key.

For administrators

The deployment guide gives the package's addresses and checksum, the identifiers device-management tools ask for, the silent install command, and the two settings a configuration profile can set.

Deployment guide for administrators

If this changes

We will continue to offer an edition of SimpleDiagrams for Mac that has no permission to connect to the internet.
Other editions or future versions may add online features, such as publishing a diagram to SimpleDiagrams on the web. They would need a new macOS network entitlement, which you can see before installing.
We will announce any such change in the release notes and update this page before that version ships. Copies from our website never update themselves, and App Store copies follow your Mac's App Store update settings, so you decide whether and when to install it.

To check the entitlements of any copy yourself, run codesign -d --entitlements - /Applications/SimpleDiagrams.app in Terminal.

Security questionnaires

Because this release keeps no customer data and cannot connect to anything, most of a cloud-service questionnaire does not apply to it. We are happy to answer the parts that do.